My signing key for software releases (minisign, key ID 0CDC6DA063220C50): RWRQDCJjoG3cDNBpGGjFdULwyP1xWiSk6MiPBFrWysMlDfVuGvaG13Xz — full verify guide:

Rajesh Medampudi

Verify — Rajesh Medampudi

Verify Rajesh Medampudi

10 hosts with APM on datadog = $460/mo before a single log line. in practice the real bill lands 2-3x that, because they meter hosts hourly and bill the whole month at the peak. honest annual range: $6k-$18k to know whether your own servers are healthy. for a small team that's not a rounding error. it's a hire. a junior engineer's quarter, handed to a vendor to tell you your CPU is high. self-hosting trades it for one fixed cost: S3 + the box it runs on.

Rajesh Medampudi

Grafana LGTM for Small Teams: What You Actually Need | Rajesh Medampudi

The realistic minimum Grafana LGTM stack — Loki, Grafana, Tempo, Mimir, Alloy on one S3 bucket — for a small team that can

#datadog #observability #selfhosting #devops

vcluster earns its weight in exactly one place: tenants that need their own crds, operators, or cluster-admin. each gets its own api server as a pod on the host cluster, a syncer schedules their pods onto the shared nodes. if your tenants trust each other and just want their own apps — namespaces + the four native controls. don't run a control plane per tenant for isolation you didn't need.

Rajesh Medampudi

Multi-Tenant Kubernetes for a Small Team | Rajesh Medampudi

Running multiple tenants on one Kubernetes cluster without a big ops team: namespaces, quotas, NetworkPolicy, RBAC, and when vCluster earns its wei...

#kubernetes #selfhosting #infrastructure #devops

networkpolicy without a cni that implements it does nothing. the api server accepts your default-deny, enforcement is zero, traffic flows anyway. the silent failure. test it: two pods, two namespaces, confirm the connection is actually refused. if it isn't refused, your policy is decorative.

Rajesh Medampudi

Multi-Tenant Kubernetes for a Small Team | Rajesh Medampudi

Running multiple tenants on one Kubernetes cluster without a big ops team: namespaces, quotas, NetworkPolicy, RBAC, and when vCluster earns its wei...

#kubernetes #security #selfhosting #devops

i'll argue for self-hosting observability. but conviction cuts both ways, so: when NOT to. if you fit grafana cloud's free tier — 10k series, 50GB logs, 50GB traces, 14-day retention, 3 users, $0 — self-hosting buys you nothing. it's a hobby with a pager. use the free tier. also skip it if nobody will own the upgrades, or if your real problem is compliance retention not cost. the strongest argument names where it loses.

Rajesh Medampudi

Grafana LGTM for Small Teams: What You Actually Need | Rajesh Medampudi

The realistic minimum Grafana LGTM stack — Loki, Grafana, Tempo, Mimir, Alloy on one S3 bucket — for a small team that can

#selfhosting #observability #grafanacloud #devops

the k8s quota gotcha that bites everyone once: set a cpu/memory quota on a namespace and every new pod must declare requests or limits, or the api server rejects it at admission. tenants suddenly can't deploy and don't know why. fix: ship a limitrange in the same namespace so pods without requests get sane defaults. quota sets the ceiling, limitrange fills the floor. together or not at all.

Rajesh Medampudi

Multi-Tenant Kubernetes for a Small Team | Rajesh Medampudi

Running multiple tenants on one Kubernetes cluster without a big ops team: namespaces, quotas, NetworkPolicy, RBAC, and when vCluster earns its wei...

#kubernetes #infrastructure #devops #selfhosting

a k8s namespace is not a security boundary. it gives you two things — naming isolation and policy scope. that's it. the isolation comes from what you wrap around it: namespace-scoped rbac (least privilege, no clusterrolebindings per tenant), resourcequota, default-deny networkpolicy. the namespace is the shelf, the controls are the lock.

Rajesh Medampudi

Multi-Tenant Kubernetes for a Small Team | Rajesh Medampudi

Running multiple tenants on one Kubernetes cluster without a big ops team: namespaces, quotas, NetworkPolicy, RBAC, and when vCluster earns its wei...

#kubernetes #security #selfhosting #devops

most teams building multi-tenant k8s skip the only decision that matters: do the tenants trust each other? yes → namespaces + rbac + quota + default-deny netpol. native, cheap, enough. no → no amount of yaml fixes a shared api server and a shared kernel. vcluster or separate clusters. walk it in order, stop at the first "no".

Rajesh Medampudi

Multi-Tenant Kubernetes for a Small Team | Rajesh Medampudi

Running multiple tenants on one Kubernetes cluster without a big ops team: namespaces, quotas, NetworkPolicy, RBAC, and when vCluster earns its wei...

#kubernetes #selfhosting #infrastructure #devops

ran the 3-year math on one personal box (4 vcpu / 16 gb): ~$195 owned (box + power), ~$972 on hetzner, ~$4,400 on aws. a $150 n100 pays its hardware back vs the cheapest serious cloud in under 6 months — under 6 weeks vs aws. after that it's ~$15/yr of electricity against $324+/yr of cloud you stopped paying. the box doesn't just pay for itself. it deletes a recurring bill you were treating as a law of nature.

Rajesh Medampudi

The Home Lab That Pays for Itself: Cost vs Cloud | Rajesh Medampudi

A mini-PC home lab beats cloud on cost — payback in under 6 months, then a coffee a month to run. The honest home-lab-vs-cloud math, with sources.

#selfhosting #homelab #infrastructure

a 10w mini-pc running 24/7 burns ~88 kwh a year. here in hyderabad that's ~₹485/yr. us average, ~$15.5/yr. i live on this box: nextcloud, self-hosted bitwarden, a bitcoin full node, a nostr relay — one modest machine, and the power cost disappears into the noise of the monthly bill. less to power for a year than two months of the cheapest serious cloud vps.

Rajesh Medampudi

The Home Lab That Pays for Itself: Cost vs Cloud | Rajesh Medampudi

A mini-PC home lab beats cloud on cost — payback in under 6 months, then a coffee a month to run. The honest home-lab-vs-cloud math, with sources.

#selfhosting #homelab #bitcoin #nostr

promtail and grafana agent are both dead. agent hit EOL nov 2025, promtail's LTS clock ran out too. if your tutorial installs either, it's stale. alloy replaces all of it — one binary collecting logs, metrics, traces, profiles, built on opentelemetry. where you ran three agents with three configs, now it's one. rare deprecation that's a refund, not a tax. there's a converter if you're migrating off promtail.

Rajesh Medampudi

Grafana LGTM for Small Teams: What You Actually Need | Rajesh Medampudi

The realistic minimum Grafana LGTM stack — Loki, Grafana, Tempo, Mimir, Alloy on one S3 bucket — for a small team that can

#grafana #opentelemetry #observability #selfhosting

the used enterprise server is a trap for a personal lab. a dell r720 idles ~100w, an r730 ~85w. an n100 mini-pc: ~10w, running the same personal stack. that's ~10x the running cost, 24/7, for cores a personal workload never touches. cheap to buy, expensive to own — you're buying someone else's discarded power bill. lifetime cost is the number, not sticker price.

Rajesh Medampudi

The Home Lab That Pays for Itself: Cost vs Cloud | Rajesh Medampudi

A mini-PC home lab beats cloud on cost — payback in under 6 months, then a coffee a month to run. The honest home-lab-vs-cloud math, with sources.

#selfhosting #homelab #hardware

single-u colo runs $79+/mo in the us — more than the ~$27 hetzner node it would replace. the same box at home: ~$1.25/mo in power. in india it's worse: rack space sells by the full rack, ₹25k–60k/mo. colo only pays off amortised across many machines, or when the workload truly needs data-centre power + network. for one personal box, it stays home. don't pay rack rent to host a pi-hole.

Rajesh Medampudi

The Home Lab That Pays for Itself: Cost vs Cloud | Rajesh Medampudi

A mini-PC home lab beats cloud on cost — payback in under 6 months, then a coffee a month to run. The honest home-lab-vs-cloud math, with sources.

#selfhosting #homelab #colocation

the $5 vps anchor is why nobody runs the home lab math. a lab doesn't replace one tiny box — it replaces pi-hole + nextcloud + jellyfin + git remote + nostr relay + side projects, plus storage, plus the egress you stop paying for. price the real spec (4 vcpu / 16 gb) honestly: ~$27/mo cheapest (hetzner, after their apr 2026 hike), ~$122/mo on aws. every month. going up. against that, a $150 mini-pc breaks even in under 6 months.

Rajesh Medampudi

The Home Lab That Pays for Itself: Cost vs Cloud | Rajesh Medampudi

A mini-PC home lab beats cloud on cost — payback in under 6 months, then a coffee a month to run. The honest home-lab-vs-cloud math, with sources.

#selfhosting #homelab #cloudcost

the part the scaling docs bury, and it's the whole thing: loki, tempo, mimir each run as a single binary — monolithic mode, every component in one process. not a hack, the supported default. grafana's own docs say monolithic handles ~20GB logs/day. then point all three at one S3 bucket. compute stays small, data lives in object storage at a couple cents/GB-month. do it day one — retrofitting storage later is the migration you don't want.

Rajesh Medampudi

Grafana LGTM for Small Teams: What You Actually Need | Rajesh Medampudi

The realistic minimum Grafana LGTM stack — Loki, Grafana, Tempo, Mimir, Alloy on one S3 bucket — for a small team that can

#selfhosting #observability #s3 #grafana

most observability advice is written for someone who isn't you. datadog's quote assumes someone else pays. the 40-service enterprise build assumes you have a platform team. small team needs neither. loki + grafana + tempo + mimir, simplest mode each, one alloy agent, one S3 bucket. one box. that's the whole thing. pick the build that matches the team you have, not the one in the tutorial.

Rajesh Medampudi

Grafana LGTM for Small Teams: What You Actually Need | Rajesh Medampudi

The realistic minimum Grafana LGTM stack — Loki, Grafana, Tempo, Mimir, Alloy on one S3 bucket — for a small team that can

#selfhosting #observability #grafana #devops

whether to leave the cloud isn't ideology. it's five questions, in order: bill under ~$2k/mo? traffic spiky? someone who WANTS to own infra? egress or steady compute your biggest cost? can you treat a hardware failure as planned, not invisible? the first "yes" that points back to the cloud wins. i run bare metal because my workload sits on the far side of all five. most don't.

Rajesh Medampudi

Bare Metal Kubernetes vs the Cloud: When It Actually Wins | Rajesh Medampudi

Bare metal Kubernetes can be 5x cheaper than AWS — but it

#infrastructure #kubernetes #selfhosting #devops

what you're actually paying aws for, and no pricing page shows it: an on-call hardware team you don't staff, elasticity for spiky traffic, and the freedom to NOT become an infra team. that last one eats senior attention — the scarcest thing a small team has. the cloud's price isn't a scam. i left, and i'd still tell most people who ask me not to.

Rajesh Medampudi

Bare Metal Kubernetes vs the Cloud: When It Actually Wins | Rajesh Medampudi

Bare metal Kubernetes can be 5x cheaper than AWS — but it

#infrastructure #kubernetes #cloud #devops

the break-even line for leaving the cloud is more specific than the zealots admit: ~$2-5k/mo spend + workloads above ~50% utilisation. below it, stay — the hours cost more than the hardware saves. above it, bare metal wins hard. a box at 15% utilisation is expensive no matter who owns it. find your number first, then decide.

Rajesh Medampudi

Bare Metal Kubernetes vs the Cloud: When It Actually Wins | Rajesh Medampudi

Bare metal Kubernetes can be 5x cheaper than AWS — but it

#infrastructure #cloudcost #finops #kubernetes

egress is the moat. ship 20 TB out of aws in a month → ~$1,800. the same 20 TB off a hetzner dedicated box → $0. you can't reserve your way out of egress the way you can with compute. it just scales with how many people use your product. if bytes-to-users is your biggest line item, that alone can justify leaving.

Rajesh Medampudi

Bare Metal Kubernetes vs the Cloud: When It Actually Wins | Rajesh Medampudi

Bare metal Kubernetes can be 5x cheaper than AWS — but it

#infrastructure #awscost #selfhosting #egress